CVE-2026-107460: CWE-918 Server-Side Request Forgery (SSRF) in Apache Software Foundation Apache Fesod (Incubating)

The vulnerability involves the UrlImageConverter component in Apache Fesod (Incubating) 2.0.2-incubating, where SSRF protection is bypassed via DNS rebinding. When an attacker-controlled image URL is accepted, the component checks the hostname's resolved IP addresses but then opens a separate connection that can resolve the hostname again, allowing the attacker to redirect the connection to restricted internal addresses. This bypasses the SSRF protections introduced in 2.0.2-incubating. The issue is addressed in version 2.1.0-incubating by disabling remote URL image fetching by default and requiring an explicit exact-host allowlist for enabling this feature.

An attacker who controls DNS responses for image URLs can bypass SSRF protections and cause the application to connect to restricted internal network addresses, potentially exposing internal services or data. This could lead to unauthorized access or information disclosure within the internal network environment where Apache Fesod is deployed.

Users should upgrade to Apache Fesod (Incubating) version 2.1.0-incubating, which disables remote URL image fetching by default and requires an explicit allowlist of trusted hostnames when enabling this feature. Applications that enable remote URL image fetching should restrict allowlists to only hostnames with trusted DNS and HTTP services. No other mitigation is indicated by the vendor advisory.